Bitte Log-File anschauen und dat.find
 

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: 2C13-4315

Verzeichnis von C:\WINDOWS\system32

15.04.2006 01:13 44 ncompat.tlb
11.04.2006 21:26 73'728 sockspy.dll
11.04.2006 21:26 77'824 xcomm.dll
11.04.2006 21:24 31 getfile.dat
30.03.2006 17:37 2'206 wpa.dbl
26.03.2006 10:41 380'350 perfh009.dat
26.03.2006 10:41 52'764 perfc009.dat
26.03.2006 10:41 391'000 perfh007.dat
26.03.2006 10:41 63'580 perfc007.dat
26.03.2006 10:41 897'778 PerfStringBackup.INI
18.03.2006 22:06 34'308 BASSMOD.dll
10.03.2006 02:10 4'799'320 MRT.exe
09.03.2006 12:41 43'520 CmdLineExt03.dll
14.02.2006 10:20 550'120 LegitCheckControl.dll
13.02.2006 20:03 8'632 spmsg.dll
08.01.2006 19:20 176'167 rmoc3260.dll
08.01.2006 19:20 5'632 pndx5032.dll
08.01.2006 19:20 6'656 pndx5016.dll
08.01.2006 19:20 278'528 pncrt.dll
06.01.2006 22:05 31'800 vsconfig.xml
05.01.2006 20:56 6'948 jupdate-1.5.0_06-b05.log
04.01.2006 05:35 68'096 webclnt.dll


Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: 2C13-4315

Verzeichnis von C:\DOKUME~1\deni\LOKALE~1\Temp

16.04.2006 12:27 16'384 Perflib_Perfdata_850.dat
11.04.2006 19:37 886 arc0006.tmp
11.04.2006 19:37 240 arc0005.tmp
11.04.2006 19:37 26'658 arc0004.tmp
11.04.2006 19:37 342 arc0002.tmp
11.04.2006 19:37 977 arc0001.tmp
6 Datei(en) 45'487 Bytes
0 Verzeichnis(se), 21'026'426'880 Bytes frei

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: 2C13-4315

Verzeichnis von C:\WINDOWS

16.04.2006 12:34 1'951'447 WindowsUpdate.log
16.04.2006 12:27 51 iTouch.ini
16.04.2006 12:26 0 0.log
16.04.2006 12:26 159 wiadebug.log
16.04.2006 12:26 50 wiaservc.log
16.04.2006 12:26 2'048 bootstat.dat
15.04.2006 23:13 32'548 SchedLgU.Txt
15.04.2006 19:43 202 NeroDigital.ini
15.04.2006 14:09 436'704 setupapi.log
15.04.2006 01:06 10'032 ModemLog_SAMSUNG Mobile USB Modem 1.0.txt
14.04.2006 14:47 54'156 QTFont.qfn
12.04.2006 18:43 1'409 QTFont.for
11.04.2006 21:24 740 win.ini
11.04.2006 19:22 226'426 setupact.log
11.04.2006 18:43 694'166 ntbtlog.txt
12.03.2006 12:42 95'412 wmsetup.log
12.03.2006 12:05 7'288 WGA.log
02.03.2006 22:33 128 GESUND.INI
20.02.2006 18:33 195'327 DirectX.log
16.02.2006 13:29 29'985 spupdsvc.log
15.02.2006 22:06 69'714 iis6.log
15.02.2006 22:06 136'172 comsetup.log
15.02.2006 22:06 81'865 ntdtcsetup.log
15.02.2006 22:06 176'876 tsoc.log
15.02.2006 22:06 19'364 ocmsn.log
15.02.2006 22:06 1'374 imsins.log
15.02.2006 22:06 10'761 KB911927.log
15.02.2006 22:06 230'741 ocgen.log
15.02.2006 22:06 22'671 msgsocm.log
15.02.2006 22:06 443'065 FaxSetup.log
15.02.2006 22:06 26'304 updspapi.log
15.02.2006 22:06 1'374 imsins.BAK
15.02.2006 22:06 6'875 KB911564.log
15.02.2006 22:06 7'351 KB911565.log
15.02.2006 22:05 9'916 KB901190.log
15.02.2006 22:04 6'770 KB913446.log
11.01.2006 23:10 10'189 KB908519.log
10.01.2006 20:57 67 AVIConverter.INI
07.01.2006 02:27 11'092 KB912919.log

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: 2C13-4315

Verzeichnis von C:\

16.04.2006 13:38 0 sys.txt
16.04.2006 13:38 8'919 system.txt
16.04.2006 13:38 540 systemtemp.txt
16.04.2006 13:38 102'145 system32.txt
16.04.2006 12:26 536'399'872 hiberfil.sys
16.04.2006 12:26 1'363'148'800 pagefile.sys
11.04.2006 19:02 3'153 smitfiles.txt






Logfile of HijackThis v1.99.1
...
[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/showpost.php?p=171957&postcount=1

danke
GUA
[/edit]

Hallo,

poste ein entsprechend bearbeitetes Logfile.

Gruß

Schrulli

Sorry

jetzt sollte es besser sein


Logfile of HijackThis v1.99.1
Scan saved at 13:39:12, on 16.04.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe
C:\Programme\Softwin\BitDefender9\vsserv.exe
C:\WINDOWS\SOINTGR.EXE
C:\Programme\Logitech\iTouch\iTouch.exe
C:\Programme\HP\HP Software Update\HPWuSchd.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\Programme\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programme\Softwin\BitDefender9\bdmcon.exe
C:\Programme\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\****\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [**]****://***.bluewin.ch/[**]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [**]****//***.medion.com/[**]
O2 - BHO: Nothing - {7a932ed2-1737-4ab8-b84d-c71779958551} - C:\WINDOWS\system32\hp48CF.tmp (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [xblgt] C:\Programme\XBOX Live Gamercard Tool\xblgt.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Programme\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Programme\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Programme\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google-Suche - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://C:\Programme\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missing
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://***.medion.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - ****://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - [**l]h**p://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab[/url]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - ****://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114887872609
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - [**]h**p://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab[/url]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - ****://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123924226234
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - [**]http://***3.ca.com/securityadvisor/virusinfo/webscan.cab[/url]
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - ****://fdl.msn.com/public/chat/msnchat45.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programme\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)